The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted web content via web_search and web_fetch to extract strategy logic, creating a vulnerability where malicious instructions in external data could influence the agent's behavior.
Ingestion points: Web search results and fetched page content used in the /research learn action.
Boundary markers: The instructions do not specify any delimiters or warnings to ignore embedded instructions within the fetched web content.
Capability inventory: The skill creates Python files (/research codify) and executes them (/research backtest), and has access to the powerful claude-code tool for shell operations.
Sanitization: There is no mention of sanitizing or validating the extracted logic before it is codified into executable Python classes.
[DYNAMIC_EXECUTION]: The skill's primary workflow involves the runtime generation of Python code based on external input. This code is then executed locally for backtesting, which represents a risk if the generated code contains malicious payloads derived from the researched sources.
[COMMAND_EXECUTION]: The /research backtest command executes generated Python scripts, which involves starting subprocesses or running interpreter commands on files created from potentially untrusted web data.

trading-research